BTCPay Server, as an open-source self-hosted Bitcoin payment processor, previously attracted sovereign users and merchants with its features of no intermediaries and no fees. Core contributors estimated that there are hundreds of thousands of running instances globally, with over a million downloads from the main GitHub repository; this vulnerability exposes its long-standing weaknesses in API permissions and credential file management.

Funds were directly transferred from Lightning node channels using the stolen LND macaroon credentials, motivated by exploiting unauthenticated remote access to bypass protections and quickly empty channel balances; similar pathways have been observed in previous incidents where funds were lost due to credential leaks or configuration errors in Lightning Network nodes.

Comparing with other self-hosted Bitcoin tools like Electrum or various node software regarding historical security incidents in credential and permission design, the current phase is a transition from functional expansion to mandatory security reinforcement in open-source payment infrastructure.

This essentially represents a regulatory change at the edge of technological substitution: the self-hosted model completely shifts security responsibility to users, and once a vulnerability is exploited, it directly leads to financial losses. The mechanism involves credential files being persistent and remotely accessible, forcing the entire network to urgently migrate to the fixed version to cut off attack pathways.

ABAB News · Cognitive Laws

The security responsibility of self-hosting always lies with the user
Credential leaks equal opening the door to funds
Open-source and free does not equal zero risk